Categories: VulnerabilityZero-Day

Facebook Patches Another Vulnerability That Exposed User’s Private Information

Facebook patched another vulnerability which allows threat actors to collect private information of facebook user’s.

Imperva Security researcher Ron Masas discovered the bug in Facebook’s Search system while browsing Facebook’s online search results, he noticed that each result contained an iframe element that is used for Facebook internal tracking purpose.

By reading the iframes he found that “most search endpoints, is not cross-site request forgery (CSRF) protected, which normally allows users to share the search results page via a URL.” Masas published a video shows that he could extract the following information by using basic yes or no question.

Masas said ZDNet that he could infer if users have liked a particular page, if they’ve taken photos at certain geographical locations, if they had friends of a certain religion in their friends list, if they’ve shared posts with a specific text, if a user has friends with a particular name, if the user has friends living in a specific city or country, and many other highly sensitive details.

To illustrate the attack he created a malicious site which popup or open the Facebook search page, then need to force the user to execute search queries.

He said by manipulating Facebook’s graph search, it’s possible to craft search queries and reflect user behavior. This is especially dangerous for mobile users since the open tab can easily get lost in the background, allowing the attacker to extract the results for multiple queries, while the user is watching a video or reading an article on the attacker’s site.

Masas reported the vulnerability to Facebook responsible disclosure program in May 2018 and the bug was resolved now.

Hackers recently exploted a Zero-Day Flaw in Facebook View As feature to steal 29 Million Accounts Access Tokens that contains information such as security credentials for a login session, user identity, and the permission.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

TikTok Hit with €530 Million Fine Over Data Transfers to China

Irish Data Protection Commission (DPC) has imposed a landmark €530 million fine on TikTok Technology…

8 minutes ago

xAI API Key Leak Exposes Proprietary Language Models on GitHub

Employee at Elon Musk’s artificial intelligence firm xAI inadvertently exposed a private API key on…

16 minutes ago

Firefox’s Future Uncertain Without Google Search Deal, Insider Warns

Mozilla's Chief Financial Officer testified that Firefox could face extinction if Justice Department proposals targeting…

20 minutes ago

Google Gemini Introduces Built-In Image Editing in App

Google has integrated advanced AI-powered image editing tools directly into its Gemini app, enabling users…

22 minutes ago

New GPOHound Tool Analyzes Active Directory GPOs for Escalation Risks

Security researchers have released GPOHound, a powerful open-source tool designed to analyze Group Policy Objects (GPOs)…

59 minutes ago

Signal App Used by Trump Associate Targeted in Security Breach

A major security scare has erupted in Washington after reports emerged that a Trump associate…

1 hour ago